| CVE-2026-57834 | 10 | critical | traffic server | Apache Traffic Server allows request smuggling if chunked messages are malformed. | 38d ago |
| CVE-2026-58150 | 10 | critical | traffic server | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. | 38d ago |
| CVE-2026-33267 | 10 | critical | traffic server | Improper Input Validation vulnerability in Apache Traffic Server. | 38d ago |
| CVE-2026-58162 | 10 | critical | traffic server | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. | 38d ago |
| CVE-2026-24014 | 9.8 | critical | iotdb | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name t | 61d ago |
| CVE-2026-48204 | 9.8 | critical | camel | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component | 61d ago |
| CVE-2026-46456 | 9.8 | critical | camel | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. | 61d ago |
| CVE-2026-43867 | 9.8 | critical | camel | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. | 61d ago |
| CVE-2026-46454 | 9.8 | critical | camel | Improper Input Validation vulnerability in Apache Camel Cometd Component. | 61d ago |
| CVE-2026-46455 | 9.8 | critical | camel | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. | 61d ago |
| CVE-2026-33264 | 9.8 | critical | airflow | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class pat | 60d ago |
| CVE-2026-47898 | 9.8 | critical | lucene.net | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Comm | 64d ago |
| CVE-2026-56140 | 9.8 | critical | camel | Improper Input Validation vulnerability in Apache Camel AWS SNS component. | 61d ago |
| CVE-2026-53913 | 9.8 | critical | camel | Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulne | 61d ago |
| CVE-2026-63038 | 9.8 | critical | inlong | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLon | 16d ago |
| CVE-2026-63037 | 9.8 | critical | inlong | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLon | 16d ago |
| CVE-2026-34884 | 9.8 | critical | skywalking mcp | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. | 18d ago |
| CVE-2026-73240 | 9.8 | critical | allura | Specifically crafted inputs may lead to git argument injection in Apache Allura. | 24d ago |
| CVE-2026-65637 | 9.8 | critical | tomcat | Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. | 11d ago |
| CVE-2026-55799 | 9.8 | critical | ranger | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to | 26d ago |
| CVE-2026-44416 | 9.8 | critical | ranger | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2. | 26d ago |
| CVE-2026-42537 | 9.8 | critical | ranger | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version | 26d ago |
| CVE-2026-40920 | 9.8 | critical | ranger | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. | 26d ago |
| CVE-2026-32227 | 9.8 | critical | ranger | SQL Injection vulnerability vulnerability in Apache Ranger. | 26d ago |
| CVE-2026-28672 | 9.8 | critical | ranger | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger | 26d ago |
| CVE-2026-45434 | 9.8 | critical | ofbiz | Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execut | 109d ago |
| CVE-2026-49845 | 9.8 | critical | hive | SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms | 11d ago |
| CVE-2026-47323 | 9.8 | critical | camel | Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilte | 109d ago |
| CVE-2026-71558 | 9.8 | critical | fory | Heap type confusion vulnerability in Apache Fory C++ deserialization. | 29d ago |
| CVE-2026-48207 | 9.8 | critical | fory | Deserialization of untrusted data in Apache Fory PyFory. | 107d ago |
| CVE-2026-44930 | 9.8 | critical | cxf | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an a | 106d ago |
| CVE-2026-68079 | 9.8 | critical | cxf | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited numb | 30d ago |
| CVE-2026-78329 | 9.8 | critical | camel | Improper input validation vulnerability in Apache Camel Undertow component. | 12d ago |
| CVE-2026-41293 | 9.8 | critical | tomcat | Improper Input Validation vulnerability in Apache Tomcat. | 116d ago |
| CVE-2026-66909 | 9.8 | critical | cxf | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializatio | 30d ago |
| CVE-2026-71300 | 9.8 | critical | camel | Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. | 12d ago |
| CVE-2026-61486 | 9.8 | critical | lucy | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. | 31d ago |
| CVE-2026-43512 | 9.8 | critical | tomcat | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. | 116d ago |
| CVE-2026-61484 | 9.8 | critical | lucy | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. | 31d ago |
| CVE-2026-47065 | 9.8 | critical | mina | ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: | 94d ago |
| CVE-2026-29167 | 9.8 | critical | http server | Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects | 89d ago |
| CVE-2026-68979 | 9.8 | critical | nifi | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authori | 33d ago |
| CVE-2026-66756 | 9.8 | critical | tika | Improper Protection of Alternate Path vulnerability in Apache Tika. | 37d ago |
| CVE-2026-52680 | 9.8 | critical | kyuubi | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a tem | 37d ago |
| CVE-2026-28812 | 9.8 | critical | jspwiki | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escala | 37d ago |
| CVE-2026-59243 | 9.8 | critical | apache-airflow-providers-fab | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an a | 38d ago |
| CVE-2026-44631 | 9.8 | critical | http server | Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. | 89d ago |
| CVE-2026-49875 | 9.8 | critical | cxf | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the nec | 85d ago |
| CVE-2026-50628 | 9.8 | critical | cxf | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blind | 85d ago |
| CVE-2026-32966 | 9.8 | critical | dolphinscheduler | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinSch | 80d ago |
| CVE-2026-63039 | 9.8 | critical | inlong | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLon | 16d ago |
| CVE-2026-66713 | 9.8 | critical | axis2\/java | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation | 39d ago |
| CVE-2026-55971 | 9.8 | critical | thrift | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. | 40d ago |
| CVE-2026-64608 | 9.8 | critical | fory | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. | 46d ago |
| CVE-2026-63071 | 9.8 | critical | syncope | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. | 47d ago |
| CVE-2026-62183 | 9.8 | critical | syncope | Improper Privilege Management vulnerability in Apache Syncope. | 47d ago |
| CVE-2026-57308 | 9.8 | critical | syncope | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Synco | 47d ago |
| CVE-2026-53421 | 9.8 | critical | syncope | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. | 47d ago |
| CVE-2026-53405 | 9.8 | critical | syncope | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. | 47d ago |
| CVE-2026-64606 | 9.8 | critical | fory | Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Jav | 46d ago |
| CVE-2026-62392 | 9.8 | critical | kylin | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache | 53d ago |
| CVE-2026-62390 | 9.8 | critical | kylin | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin | 53d ago |
| CVE-2026-65905 | 9.8 | critical | tomcat | Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. | 11d ago |
| CVE-2026-41920 | 9.3 | critical | traffic server | Improper Access Control vulnerability in Apache Traffic Server. | 38d ago |
| CVE-2026-49871 | 9.3 | critical | apisix | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. | 78d ago |
| CVE-2026-58155 | 9.3 | critical | traffic server | Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy by | 38d ago |
| CVE-2026-42535 | 9.1 | critical | http server | A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipu | 89d ago |
| CVE-2026-58023 | 9.1 | critical | thrift | Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. | 40d ago |
| CVE-2026-59083 | 9.1 | critical | tomcat | Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security c | 53d ago |
| CVE-2026-48144 | 9.1 | critical | thrift | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. | 40d ago |
| CVE-2026-71290 | 9.1 | critical | httpclient | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. | 25d ago |
| CVE-2026-61398 | 9.1 | critical | cloudstack | Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Passwor | 15d ago |
| CVE-2026-65182 | 9.1 | critical | tomcat | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypas | 11d ago |
| CVE-2026-62440 | 9.1 | critical | cloudstack | Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenan | 15d ago |
| CVE-2026-55976 | 9.1 | critical | hive | Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authentic | 11d ago |
| CVE-2026-64609 | 9.1 | critical | fory | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. | 46d ago |
| CVE-2026-48203 | 9.1 | critical | camel | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input | 61d ago |
| CVE-2026-66906 | 9.1 | critical | camel | Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. | 12d ago |
| CVE-2026-43515 | 9.1 | critical | tomcat | Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension | 116d ago |
| CVE-2026-71560 | 9.1 | critical | fory | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. | 29d ago |
| CVE-2026-31986 | 9.1 | critical | ofbiz | Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. | 109d ago |
| CVE-2026-41919 | 9.1 | critical | ofbiz | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz | 109d ago |
| CVE-2026-41041 | 9.1 | critical | gravitino | URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. | 54d ago |
| CVE-2026-50627 | 9.1 | critical | cxf | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT acce | 85d ago |
| CVE-2026-58319 | 9.1 | critical | doris | Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. | 53d ago |
| CVE-2026-48205 | 9.1 | critical | camel | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. | 61d ago |
| CVE-2026-40047 | 9.1 | critical | camel | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel D | 61d ago |
| CVE-2026-69223 | 9.1 | critical | allura | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). | 25d ago |
| CVE-2026-58662 | 9.1 | critical | thrift | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings | 40d ago |
| CVE-2026-49230 | 9.1 | critical | apisix | Improper Validation of Integrity Check Value vulnerability in Apache APISIX. | 78d ago |
| CVE-2026-59085 | 9.1 | critical | cloudstack | Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook de | 15d ago |
| CVE-2026-68525 | 9.1 | critical | tomcat | Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a sec | 11d ago |
| CVE-2026-34191 | 9.1 | critical | apr-util | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Porta | 30d ago |
| CVE-2026-32327 | 9.1 | critical | apr-util | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which p | 30d ago |
| CVE-2026-24013 | 9.1 | critical | iotdb | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. | 61d ago |
| CVE-2026-65583 | 9.1 | critical | cxf | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required cla | 30d ago |
| CVE-2026-63687 | 9.1 | critical | cxf | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map | 30d ago |
| CVE-2026-42252 | 9.1 | critical | airflow | Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags" | 96d ago |
| CVE-2026-53434 | 9.1 | critical | tomcat | Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based c | 68d ago |
| CVE-2026-32967 | 9.1 | critical | dolphinscheduler | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. | 80d ago |
